The Agent Skills Directory

[DATA_EXFILTRATION]: The instructions in SKILL.md mandate that the agent read sensitive configuration files including .env and .env.* to scope the setup procedure. This pattern risks exposing active credentials and API keys to the model's context.
[COMMAND_EXECUTION]: The skill's purpose is to author executable bash scripts which the user is then prompted to run. This introduces a risk where the agent might generate and recommend the execution of malicious shell code based on its analysis of the repository.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of untrusted repository files.
Ingestion points: Repository files such as README.md, docker-compose.yaml, and framework configurations are read by the agent (SKILL.md).
Boundary markers: The instructions lack markers or safety warnings to prevent the agent from following instructions embedded within these files.
Capability inventory: The generated script can modify local .env files and use the gh CLI to update GitHub repository secrets (template.sh).
Sanitization: There is no evidence of sanitization or validation logic to ensure that data pulled from the repository does not contain malicious bash snippets or logic overrides.

wizard